Lateral movement detection using a mixture of online anomaly scoring models

A method, comprising:

• performing, by one or more computers that implement a cyberattack detection system:
• receiving a stream of connections observed among nodes of a computer network;
• for individual connections in the stream:
• determining a first anomaly score for the connection using a first machine learning model, wherein
• the first machine learning model is an incremental matrix factorization model,
• updating the first machine learning model based on the connection using a first online machine learning technique,
• determining a second anomaly score for the connection using a second machine learning model of a different type from the first machine learning model, wherein
• the second machine learning model is a connection count fitting model,
• updating the second machine learning model based on the connection using a second online machine learning technique;
• generating a plurality of connection paths, wherein each connection path includes an acyclic sequence of time-ordered connections in the stream;
• identifying one or more suspected lateral movement paths in the connection paths based on the first and second anomaly scores of the connections in the connection paths;
• and
• outputting an alert indicating the one or more suspected lateral movement paths.

One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors implement at least a portion of a cyberattack detection system and cause the cyberattack detection system to:

• receive a stream of connections observed among nodes of a computer network;
• for individual connections in the stream:
• determine a first anomaly score for the connection using a first machine learning model, wherein
• the first machine learning model is an incremental matrix factorization model,
• update the first machine learning model based on the connection using a first online machine learning technique,
• determine a second anomaly score for the connection using a second machine learning model of a different type from the first machine learning model, wherein
• the second machine learning model is a connection count fitting model, and
• update the second machine learning model based on the connection using a second online machine learning technique;
• generate a plurality of connection paths, wherein each connection path includes an acyclic sequence of time-ordered connections among the nodes of the computer network;
• identify one or more suspected lateral movement paths in the connection paths based on the first and second anomaly scores of the connections in the connection paths;
• and
• output an alert indicating the one or more suspected lateral movement paths.